[SECURITY] [DSA 2477-1] sympa security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2477-1 [email protected] http://www.debian.org/security/ Florian Weimer May 20, 2012 http://www.debian.org/security/faq -...

CVE-2012-2352

The archive management arcmanage page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the 1 doarcmanage, 2 doarcdownload, or 3 doarcdelete functions...

CVE-2012-2352

The CVE-2012-2352 entry applies to Sympa’s archive management (arc_manage) page (wwsympa/wwsympa.fcgi.in) prior to version 6.1.11. The underlying flaw is a missing permissions check on the arc_manage interface, which allows remote attackers to list, read, and delete arbitrary list archives via th...